Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use private cgroup namespaces for cgroup v2 #63

Draft
wants to merge 1 commit into
base: main
Choose a base branch
from
Draft

Use private cgroup namespaces for cgroup v2 #63

wants to merge 1 commit into from

Commits on Feb 9, 2024

  1. Use private cgroup namespaces for cgroup v2 

    Using the host's cgroup namespace along with a writable mount of the
entire cgroup fs messes with container isolation quite a bit. The main
purpose of this is to get a writable mount of the cgroup fs inside
containers, so that init systems are able to set up their own cgroups
accordingly.

Use a different approach to achieve the same effect: Use a private
cgroup namespace. Privileged containers will automatically have write
access. A read-write mount is only performed when running non-privileged
containers.

Signed-off-by: Tom Wieczorek <twieczorek@mirantis.com>
    @twz123
    twz123 committed Feb 9, 2024
    Configuration menu
    Copy the full SHA
    48233bc View commit details
    Browse the repository at this point in the history